CVE-2026-21413: 
NixOS vulnerability analysis and mitigation

CVE-2026-21413 is a heap-based buffer overflow vulnerability in the lossless_jpeg_load_raw functionality of LibRaw, an open-source C/C++ library for reading and processing RAW image files. It affects LibRaw commits 0b56545 and d20315b (versions 0.22.0 and 0.22.1), and was discovered by Francesco Benvenuto of Cisco Talos. The vulnerability was disclosed to the vendor on February 12, 2026, patched on April 6, 2026, and publicly released on April 7, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (Talos Report, GitHub Advisory).

The root cause is improper validation of an array index (CWE-129 / CWE-787) in LibRaw::lossless_jpeg_load_raw() within src/decoders/decoders_dcraw.cpp. The function processes Canon CR2 files using a "slicing" scheme controlled by the CR2Slice TIFF tag (0xC640), whose values (cr2_slice[0], cr2_slice[1], cr2_slice[2]) are read directly from the attacker-supplied file. The column index col is computed as jidx % cr2_slice[1+j] + i * cr2_slice[1]; while row is validated against raw_height, col is never validated against raw_width, allowing it to grow arbitrarily large when cr2_slice[1] is inflated. The resulting RAW(row, col) macro write (raw_image[row * raw_width + col]) then writes a 16-bit value — fully attacker-controlled via the TIFF LinearizationTable tag (0xC618) — to an out-of-bounds heap location, enabling heap corruption and potential code execution (Talos Report).

Successful exploitation allows an unauthenticated remote attacker to achieve arbitrary code execution with the privileges of the process running LibRaw, by supplying a specially crafted CR2 or JPEG-compressed RAW image file. The attacker has full control over both the out-of-bounds write offset and the 16-bit value written, making exploitation highly reliable for heap corruption. Any application that calls unpack() on untrusted image files using a vulnerable LibRaw version is at risk, including photo management software, image processing pipelines, and web services that accept RAW image uploads (Talos Report, Red Hat Bugzilla).

No confirmed in-the-wild exploitation has been observed, and no standalone weaponized exploit code is publicly available. Cisco Talos published a technical advisory (TALOS-2026-2331) with source code analysis and an AddressSanitizer crash trace, but this does not constitute a functional exploit. The EPSS score is approximately 0.043–0.078%, indicating low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the absence of active exploitation, the critical CVSS score (9.8), network-accessible attack vector, and no required authentication or user interaction represent significant risk (Talos Report, GitHub Advisory).

1. Craft a malicious CR2 file: Create a Canon CR2 RAW image file with a manipulated CR2Slice TIFF tag (0xC640). Set cr2_slice[0] to a non-zero value to activate the slicing code path, and set cr2_slice[1] to a large value (e.g., 512 or greater) to cause the computed col index to exceed raw_width.
2. Control the written value: Embed a custom LinearizationTable (TIFF tag 0xC618) in the file to populate the 65536-entry curve array with attacker-chosen 16-bit values, giving full control over what is written to the out-of-bounds heap location.
3. Embed a valid lossless JPEG bitstream: Include a lossless JPEG bitstream within the CR2 file that, when decoded by ljpeg_row(), produces pixel values (*rp) that index into the attacker-controlled curve array.
4. Deliver the file to the target: Submit the crafted file to any application that processes it with a vulnerable LibRaw version (e.g., upload to a photo service, send via email to a client that auto-previews RAW files, or place it in a directory scanned by a media indexer).
5. Trigger heap corruption: When the application calls LibRaw::unpack(), the lossless_jpeg_load_raw() function writes the attacker-controlled value to an out-of-bounds heap address, corrupting heap metadata or adjacent objects.
6. Achieve code execution: Leverage the heap corruption (e.g., by overwriting a function pointer, vtable entry, or allocator metadata) to redirect execution flow and execute arbitrary code with the privileges of the vulnerable process (Talos Report).

• File System: Presence of anomalous CR2 or RAW image files with unusually large or malformed CR2Slice TIFF tag (0xC640) values; unexpected files written to directories accessible by the LibRaw-using process after image processing.
• Process: Unexpected child processes spawned by image processing applications (e.g., shells, network utilities like curl or wget) following ingestion of a RAW image file; application crashes or core dumps in processes calling LibRaw::unpack().
• Logs: Application crash logs or core dumps referencing LibRaw::lossless_jpeg_load_raw() in decoders_dcraw.cpp at line 592; AddressSanitizer output indicating heap-buffer-overflow at LibRaw::lossless_jpeg_load_raw().
• Network: Outbound connections from image processing services to unknown external hosts shortly after processing a user-supplied RAW image file.

The vendor released a patch on April 6, 2026; users should update LibRaw to a version beyond commit d20315b (i.e., beyond 0.22.1). Red Hat has issued multiple errata addressing this vulnerability across RHEL 8 and 9 variants, including RHSA-2026:11360 (RHEL 9), RHSA-2026:13284 (RHEL 8), and several EUS/SAP/TUS variants (Red Hat Bugzilla). OpenSUSE and Amazon Linux 2 have also released updated packages. As a workaround where patching is not immediately possible: validate and reject untrusted CR2/RAW image files before processing, run LibRaw-based applications in a sandboxed or privilege-restricted environment (e.g., containers, seccomp profiles), and avoid exposing image processing services that accept arbitrary RAW files directly to untrusted networks (GitHub Advisory).

Cisco Talos published the detailed technical advisory (TALOS-2026-2331) on April 7, 2026, crediting researcher Francesco Benvenuto for the discovery. Talos also published a blog post summarizing Foxit and LibRaw vulnerabilities together (Talos Blog). The vulnerability received coverage from The Hacker Wire and was discussed on security-focused social media platforms including Bluesky and the oss-security mailing list. CISA included it in its weekly vulnerability bulletin (SB26-103) for the week of April 6, 2026. Community reaction has been measured, noting the critical CVSS score but absence of active exploitation.